Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

I get tired of changing passwords because I tend to forget the new one. I'd rather just keep it. For crucial things like banking or stocks, then I'll use a separate unique PASS and then lock it in a safe for future referral.

We have a password expiration policy at my work. Every time I change my password I have to memorize a new one. So I pick a password that's easy to remember, as such it's also easy to guess. If I could just memorize a password once, and keep it forever I'd be using a password that's essentially random. This policy is nonsense.

And don't forget the arbitrary rules put in place to ensure "strong" passwords - with each ruleset being different depending on the environment or portal being secured. My personal favourite: "No repeating characters allowed." Super idea! Let's force users to weaken their passwords by eliminating the possibility of duplicate characters in strategic locations.

Here's a nice argument to beat the Password Police over the head with (from TFA):

In the paper, Herley describes an admittedly crude economic analysis to determine the value of user time. He calculated that if the approximately 200 million US adults who go online earned twice the minimum wage, a minute of their time each day equals about $16 billion a year. Therefore, for any security measure to be justified, each minute users are asked to spend on it daily should reduce the harm they are exposed to by $16 b

Sounds like a bad application of math to me. (I admit, though that I only skimmed through the report, so I could be wrong)
There are two sides to a risk analysis, the probabilities and the values being risked. People will play the lottery even when they don't have a reasonable chance, because the thing being risked is not that valuable. But they are not willing to risk their life savings when the odds are slightly in their favor, because they can't repeat the bet 100 times to try and come out ahead on average.
If I'm the owner of a business, and I'm paying my employees X time the minimum wage, and a breach costs me Y dollars, I can live with the math. But if there's even a small chance that a breach will cause the death of my business, then I'm willing to have my employees spend "more than it's worth".

And don't forget the arbitrary rules put in place to ensure "strong" passwords - with each ruleset being different depending on the environment or portal being secured. My personal favourite: "No repeating characters allowed." Super idea! Let's force users to weaken their passwords by eliminating the possibility of duplicate characters in strategic locations.

Actually the Enigma is a good example of how a system is weakened by its users. Yes the cipher had weaknesses such as never encoding a character to itself and that the rotors were in alphabetic order rather than randomized. But the main weakness was the users and the Allies exploited that.

The machine itself had a number of settings. With all these settings, the Enigma messages could have daily and message specific settings. For the Army and Luftwaffe, it was left up to the operator to set them. Unfortunately, some operators were lazy and re-used settings. Also the German military had a habit of re-sending the same messages again and again for propaganda, morale, etc.

The German Navy was much more disciplined. They issued code books that specified many of the settings per day. These settings were much more randomized. These code books were printed on specialized paper that would disintegrate in contact with water. This system was much more secure until the Allies captured some code books when they captured a German vessel. The procedure was the captain was to destroy the code books by tossing them into sea. The captain of a disabled vessel abandoned it only to return to retrieve his personal effects rather than destroy the books.

The thing that worries me most about that is that it seems to indicate that they're storing the passwords plain text rather than hashing them, so they're limited to whatever field width the DB designer pulled out of his ass that day.

Even if it is a hash, the old UNIX crypt(3C) function only hashed the first 8 characters. So you could have what you thought was an arbitrarily-long password, but an attacker only needed to go after the first 8 characters.

If you were using the presumed length to use an English phrase (for example), you could wind up with a very weak password. "passwordisreallylongsoimsafe" would be unlocked with "password", which is fairly early in the dictionary attacks I've seen.

We have a password expiration policy at my work. Every time I change my password I have to memorize a new one. So I pick a password that's easy to remember, as such it's also easy to guess. If I could just memorize a password once, and keep it forever I'd be using a password that's essentially random. This policy is nonsense.

Password rotation doesn't help with hackers, but it helps when a coworker learns what your password is.

What is might do is limit exposure. Suppose someone guesses a password. They are not a hacker and even having guess a password they perhaps lack priviliges to make any systemic changes given them a back door. Having a rotation policy ensures they are only reading your CEO's e-mail for 90 days rather than years undetected.

Any halfway decent password system only stores a hash of the password, and therefore can't tell if you only changed 1 character on your password, because it has no idea what your previous password was, only what your previous password hashed to.

take for example a password like '4ey3ts' now, lets say that i have rolling password updates, so i hash in the month that it changed as follows. '4ey3ts' + 'M2rc4"(march), so i get a password of '4ey3tsM2rc4', then in april, '4ey3tsApr17'. you could do this the other way as well, 'M2rc44ey3ts'

Expiring passwords make sense - IF you are in a situation where you run a regular risk of passwords being exposed.

A worse problem is the fact that people use the same password for everything - bank account, hotmail, gmail, work, etc. One of them gets compromised by someone and all of a sudden their whole life is exposed.

Of course, the best way to get a user to be properly educated about securing their information is to have their identity stole

When a user changes their password, a post-it note goes on their monitor for weeks.

If a user picks only one password and keeps it forever, they will typically pick a stronger password, protecting against brute force dictionary attacks.

However, keeping the same password does not protect against malicious ex-employees. I know companies that do not change admin passwords, and although they are complex, previous administrators still have access to certain info if they wish.

find a schemelike if it is October 2010 make your password11Nov2010Ber!!If it is December12Dec2010Ber!! ectPasswords that have rationale behind them are very easy to remember, can be very complex and sometimes easy to type.

There is a flip-side to this. No matter how careful you think you are, you will one day expose your password in the clear. Once that happens you have no way of knowing if anyone was watching.

Typing a password in the wrong terminal, typing a password in the wrong web field and having it autosearch google for your password. Typing your password over a bluetooth wireless keyboard with unknown encryption. Using a telnet session, etc. Logging in using a friend or co-workers PC that may have been compromised, etc.

Because of all this, it's still a good policy to change passwords on an annual basis, with an immediate password change if you know it's been leaked.

I encourage companies to move to single sign-on, since I consider having to memorize 17 passwords for one company to be more hassle than having to change a password frequently.

Or having to change a password on a system you only login to once every 6 months, every time you login. I hate that.:)

Unfortunately, it doesn't always work out because one centralized password means you trust one department of a company with access to everything (there are workarounds for this, but still company politics gets in the way)

On our LAN I put rational policies in place. Essentially I look at the threat of an event and what it will take to mitigate it. If I am worried about a brute force attack I can solve that by password rotation or increasing complexity. I let the user choose which they are comfortable with. Some users dont want to use a passphrase so they have to change their password more often. Other people have realized that "I love my dog fluffy." is really easy to remember and since it meets my complexity and length requirements I make the password rotation much much longer.

Yes, In 2008 AD you can do granular password policies, and yes this works VERY well. Not only do I have a pile of users with 15+ characters, I have users who WANT to use these passwords.

I find that when you give the users a choice and work with them, security goes much smoother. users will always take the easiest way out, every time.

That poses a challenge for the security industry, Herley said. While doctors can cite statistics showing smoking causes cancer, and road-safety engineers can produce miles of numbers supporting seat belt use, computer security professionals lack such compelling evidence to give their advice clout. "Unbelievable though it might seem, we don't have data on most of the attacks we talk about," he said. "That's precisely why we're in this 'do it all' approach."

> It goes into the password expiration paradigm as well, pointing out that if> someone steals your house key, they're not going to give you time to change> the locks; they're breaking in immediately.

Not likely. Perhaps if they pick it out of my pocket as I am getting in the car to go to work they will walk straight up to the house and let themselves in (BTW it isn't breaking if they have a key). Far more likely, though, it will take days or weeks to figure out what the key fits, get it into the h

Depending on how its implemented... If it's using the default options built in to active directory for instance, then the password policy only really pays lip service to security while still being extremely weak...You might be required to use mixed case letters and numbers, and change your password every month or so... But it still doesn't stop you having weak passwords, for instance "Password1" is perfectly valid under every implementation i've seen, and when it forces you to change your password "Password

1. Find out the name of their youngest non-estranged child. If there is a tie, pick the one with the shorter name. (e.g. Cody)2. Take today's date, and subtract from it the lesser of the employee's start date, or the implementation of the password expiration policy (Apr 13th 2010 - Apr 1st 2009 = 12 months)3. Divide the result of step 2 by the password expiration window (say 3 months)

What a waste of a perfectly good pretend. No thanks, I'm going to pretend I'm on a white sand beach in Thailand, gentle waves lapping at the nearby shoreline, while I sip gin tonics and a dainty masseuse massages my pale white calves.

I was under the impression that the -vast- majority of compromised passwords were due to either social engineering (Hey, this is "Bill from IT", I need your password to fix that "performance issue" you're having) or sheer neglect on the part of the the user (password on a post-it on the monitor). Am I mistaken?

I was under the impression that the -vast- majority of compromised passwords were due to either social engineering (Hey, this is "Bill from IT", I need your password to fix that "performance issue" you're having) or sheer neglect on the part of the the user (password on a post-it on the monitor). Am I mistaken?

Scenarios like stealing passwords from post-its are certainly possible, but I'd guess as a percentage of all stolen passwords it's insignificant to being at the point of near zero. Most people don't have access to the physical space of the person they're trying to hack. I'd argue most successful password stealing is done remotely, against victims the target doesn't even know.

The big ones are going to be things like dictionary attacks against a login page where it can guess stupendously stupid/common pass

Had an instructor once whose day job was penetration testing for financial institutions. He and his partner would show up at the site and he would start unpacking the equipment they would use to probe the external connections to the network. While he was doing this his partner would get on the phone and start calling branch offices, asking to speak to the manager claiming to be from the IT department. He said that in three years he had never finished setting up before his partner had managed to secure a login and password.

Amusingly enough, they learned quickly not to bother with rank and file employees. Most of those folks were aware that they would be out the door if they were stupid enough to hand over a login and password to a voice on the phone, but managers always seemed to think they were too important to be fired, so too important to have to pay attention to minor issues like security policies.

Pretend it would take about two months of processing time for a computer or cluster of computers to crack your 16 character length password with symbols, uppercase, lowercase and numbers. Now imagine that if your password were to be changed every month that the two month duration attempt to crack the password is useless since the password has changed and another two month attempt would have to be initiated.

That is an incorrect argument made by somebody who knows nothing about statistics.

First, if the time taken to crack a password is two months, and you change your passwords every two months, then there's a 50% chance of cracking the password in the first attempt, and a 100% chance of cracking the password the second attempt. So your example doesn't work.

Now, suppose a cracker has a, say 1% chance of guessing a password per month of attempts, and is attacking, say, 10,000 accounts. On the average, the cracker will have a ten hits every month, but he will only break your account, on the average, once every 8 years. Still, that's a 12 percent chance of you getting compromised in a year, and a 6 percent chance you'll get hit in six months. So, can you reduce that 6 percent chance by changing your password every 2 months? NO. The chance that your change password moves into the window of passwords that the cracker is going to try next month is exactly equal to the chance that the password change moves the password out of the window the cracker is trying. The odds of the cracking succeeding does not change at all by password changing.

The number of passwords that the cracker guesses per month does not change.

Ah, but people inevitably give their password to a co-worker who then gets fired. The 2 month rule takes care of that situation.

Annoying 100% of your workforce with stupid rules that hurt security more than they help it, is an excellent way to shore up failing internal procedures. I'm equally sure most people who get fired will wait a month on average before doing something rash in a fit of anger.

Pretend that if an attempt to log into his account fails three times, his account is locked and requires a new password.

Or pretend that your security system notes what IP address such failures comes from, and disables all access from that IP. Or it scores various IP connections, giving more trust to IP addresses that are successful.

Whenever I see the onus forced on users, I see people who haven't learned the wisdom of the following quote:

Since we're pretending, let's pretend your imaginary computer cluster actually exists. Now let's find us the speed that said computer would have to run at to crack that password in 2 months.
A 16 character password with symbols (12), numbers (10), lowercase letters (26) and uppercase letters (26) would have 76^16 combinations. This is approximately 1.24 * 10^30th.
An MD5 hash takes 256 clock cycles in the best-case scenario (search for 256) [freepatentsonline.com], assuming no overhead. That means that we have 3.17*10^32 number of clock cycles that must be ran through in order to compute/crack every possible password in that range.
Two months is approximately (365.242199 days/year)(2/12)(24hours/day)(3600seconds/hour) = 5259488 = 5.26*10^6 seconds.
In that time, a "computer or cluster" would have to run at (3.17*10^32 cycles)/(5.26*10^6 seconds) = 6.03 * 10^25 Hz. That's 6.03 * 10^16 GHz, or 60.3 yottahertz.
Currently, the world's fastest supercomputer is the Cray Jaguar. It has 224256 opteron cores clocked at 3.2Ghz. That means it's total processing speed (again, assuming no overhead here) is 7.18*10^14 Hz. Your pretend "computer or cluster" is 84027852100 times as fast as the worlds fastest supercomputer. 84 billion times as fast.
Using the same architecture as the Cray Jaguar, the world GDP couldn't afford to buy that computer. The world's power grids couldn't power it. This is/., know the math behind your arguments before you post.

There are 22 printable symbols on a standard keyboard, not 12: `~!@#$%^&*()-_=+[{]}\|;:'",<.>/?

Also, there should be 74^16 (8.09 * 10^29) combinations with 12 symbols (not 76^16), or 84^16 (6.14 * 10^33) using all symbols. Still far more than anyone could expect to test, of course—though other weaknesses could save an attacker the trouble of brute-forcing every single combination. For example, many common systems use hashes much weaker than MD5.

it would be a matter of a simple lookup since all the "grunt" work has been done already.

Not quite. There are no tables that exist, nor can they exist, that have 16 character passwords with the given qualifications. Assuming you could generate the tables, which as my comment above [slashdot.org] shows as being not possible, let's find out just how much space that table would require to store.
MD5 hashes are 128 bits. The corresponding password, assuming 8 bits per character, is also 16*8=128bits. Assuming no overhead, that means we have 256 bits, or 32 bytes per password. Using the calculation in my previous post, 16 character passwords with those qualifications have 1.24*10^30 combinations. That means 3.96*10^31 bytes would be required to store this. How much is that? Let's put it this way - SI prefixes don't go up that high. Why? Because it's such an astronomically large number that there is no reason (yet) to have naming conventions that high. The entire internet is estimated to have 5*10^20 bytes [guardian.co.uk]. The amount of hard drive storage in every computer ever made by man combined doesn't have the necessary storage to hold that rainbow table.

Yeah, and if they beat you over the head with a rubber hose, you will tell them what your password is anyway. The rotating character / shifted field approach may not be the best policy for nuclear weapons unlock codes but it's probably OK for 'generic' level stuff.

If you're doing something very secure with passwords, you're doing it wrong anyway.

Password aging is one of those policies that sounds like it makes some degree of sense only if you don't have any understanding of human nature.

Here in reality, forcing people to change their password every 30 or 60 or 90 days only has a few possible results:

(1) A lot more people writing down passwords and sticking them to their monitors. Who the hell can remember a new eight-digit string of nonsense every month?(2) A lot more easy-to-guess passwords(3) Incremented passwords (FuckTheSecurityGuys14)

This is why I consider password policies a great indicator of where your IT department is on the "keepin' it real" scale: No restrictions, you IT people are idiots and don't care or understand security. Reasonable restrictions (min 8 characters, letters and numbers) and you're in the sweet spot. Passwords that expire every 15 minutes, your IT people are idiots and don't care or understand security.

You neglected another possibility: your security restrictions were set by some dumbass in a state legislature who read some paper or book regarding "IT Security" and passed laws and regulations for government agencies...

Yes, yes. This is all very fine. Until there is a massive security breach (like this recent one [thejournal.com]) and the CEO is looking for a place to drop the blame-hammer. Password aging may have had nothing to do with the breach, but who cares? The IS dept didn't have one? It's their fault then....

And this points to a huge problem in IT departments, companies in general and our whole society. So much effort needs to be put into CYA activities, not because you're not doing your job right, but because you are liable to be subject to the whimsical judgement of stupid or ignorant people. Appearing to do the right thing is perceived as much more important that actually doing the right thing because failures of appearance tend to have much worse consequences. Look at Congress, 90% of what they do is so they appear to taking positive action on some issue, regardless of the effects it will have. And for them, it clearly works because they keep getting re-elected despite being the most consistently incompetent group of people drawing a salary in the U.S..

Password aging is one of those policies that sounds like it makes some degree of sense only if you don't have any understanding of human nature.

The stereotype is that computer geeks can't get a date or fit into social situations. Why? Because they don't understand human nature. And who is in charge of setting the password policy? The geekiest guy in the organization. I see a major issue.

Password aging does not prevent the cracking of passwords, it prevents against leaving compromised account around forever.

Password aging made sense, once upon a time. When the biggest issue was resource theft, changing passwords every few months cleaned out the unintended access some people had, either nefariously or through chance (old unclosed account and what have you).

Now with the speed of automated hacking tools password rotation is less than useless as a defense.

I've been doing columns of keys on they keyboard, It's going to be a long time before I run out, and meets most requirements. (Sometimes I hit a caps lock for the second set), Plus logging in takes almost no time at all.

I often tell people at work I'll be adding a squirrel noise requirement to the password policy next month. I always expect them to laugh but they usually just have a horrified look on their face that reads something like 'you can do that?'. I then have to clam them down and tell them I'm only kidding.

It seems you have forgotten the other common user behavior... sharing passwords.

One of my reporting users had direct SQL access to a replicated and sanitized (no sensitive data) copy of our Database. He is an advanced user with plenty of reporting knowledge and we required ad-hoc reporting that did not damage/slow production.

during a security audit, I was required to expire his password.

the next day we had 9 tickets from 9 different users: "My access was taken away"

Password aging is not only irritating for users, it causes them to choose even worse passwords, or to write their passwords down. If you are lucky, and they do neither of these, then it is very likely that they will use "strong-password-1", "strong-password-2".

I do roughly that. I use "strong-password-2.718281828459" "strong-password-3.1415926535" "strong-password-1.6180339887" and so-on and so forth. It goes from "guess the 20-character random string" to guess the constant of the month.

Please cite some incidents traceable to the writing down of passwords.

IMHO users should be instructed to write their passwords down in a little black book and to keep that book in their wallets with their money and credit cards. The company should issue the book and teach the employees how to record passwords in it, how to keep it secure, and what to do if it is stolen or lost.

Kudos to the/. editors for cutting way down on the number of dupes and summary-contradicts-article stories over the past couple of years, but they're certainly not eradicated. Maybe dupe-checking should be part of slashcode--an automatic search for links and link titles that the editor (or submitter?) has to at least scroll past to post.

I understand the whole point behind having a secure, random password with a limited life. At the same time, I also have a piss-poor memory for random strings of ASCII characters. I don't work for a government agency, or a company with classified or even proprietary works, yet, even my mindlessly boring personal email account requires an 8 character random string with alpha and numerical characters, no runs, no common words, and no repeats. I don't use that account for ANYTHING secure or private, and if it w

I'll volunteer: 11111. I figure it's such a terrible password that brute-force software, giving humanity the benefit of the doubt, will have removed it as an option for the purposes of optimization. Thus it is the strongest password.

The real problem with password expiration is that the benefit is not clearly understood.

What does it combat?

Once someone HAS the password, you are faced with closing the barn door scenario. Anything that could have been taken or accessed, likely already was. Granted you may prevent them from acquiring additional information or access, but you can't be sure that they haven't made any backdoors, even if those backdoors aren't even related to your system. With your email, I could easily construct a spear ph

There is one thing worse than a bad password, and that is one that needs to be written down on a post-it note.

I see password security as an exponential curve, on a graph, reaching a certain peak and then dropping to zero. That dropping point is where the password rules become so complicated that most people would rather write the password down than try to remember it. That piece of paper suddenly became your weak point in the security model. For this reason you password policies need to focus on something that is sufficiently secure, but not so secure that it is in effect insecure.

uhh... an exponential curve keeps going up. there's no maximum, no dropping down to zero. Perhaps you're thinking of a bell curve? Feel free to mod this comment down because it provides no useful content and is just kind of snarky. In fact, I should just hit the cancel button instead of the preview/submit buttons. oops...

You're thinking of something rather akin to a Laffer curve, [wikipedia.org] the idea that taxing income at 0% and 100% will both realise zero revenue (the latter since no-one would work as you'd receive no income for yourself). Similarly, if we impose no requirements whatsoever on passwords, we end up with no security, since people will leave them blank. If we demand 128 character passwords with maximum entropy, we have no security, since it will be guaranteed to be written down somewhere stupid. Somewhere, there has to

I used to work a government facility that had really steep requirements:

"Passwords must be at least 15 characters long and be a combination of lowercase, uppercase, numerals, special characters, and at least one hieroglyph from the following languages: Aztec, Egyptian, or Mayan."

I would have written down my passwords but I can't draw that well. "Is this a stork, Anubis, or a hippo?"

They also had armed security guards wandering the halls. You had 3 chances to get the password right or they would send in the guards to blindfold you and take you away to be "liberated."

We're all good at securing small pieces of paper. I recommend that people write their passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet.

The author makes a good point- users see the time cost of missing assignments as more damaging to their career than the benefits of following security protocol to the letter. They're probably right.

What's interesting, I believe, is that the security employee is being fairly rational by implementing every possible security mechanism, eg CYA-type behavior. Security people tend to get a lot of stick-motivation when there's a problem but very little carrot-motivation for minimizing the intrusiveness/timewasti

How many times have you seen "the password must be between x and y characters in length and must contain blah blah"?

I want to enter a full sentence. Like "this is my password and you won't be able to guess it, you idiot". You aren't making this possible, because you're thinking like geek programmers who use randomly-generated strings of 8-12 characters by the dozens.

I write code and do inter-office support for my apps. Do you know how many times someone told me "I forgotz my password, halp!!11" after they were instructed to use a full sentence with a minimum of twenty-five characters? Zero. Nobody ever forgot it.

Password aging should automatically take into account the security of the password someone creates, via some algorithm that estimates 'guessability'

If it's a dictionary word and number, give it three months. If it's a dictionary word, number, and two symbols, give it six months. If it's a passphrase, all regular dictionary words but not a 'standard' phrase like 'lorem Ipsum" or "The quick brown fox' leave it alone for a couple years.

In other words - if someone is using a secure password, fuckin' reward them

Increased security always decreases usability. Though now that I think about it, I'm wondering: why aren't smart cards used more in corporations? Wouldn't it be convenient for people to log in with the same ID they use to get into their workplace building or floor?

This is not true. How useable would Facebook be without requiring a password to log in? Yes it would be easier to get in, but you would lose any trust in the application as anyone could be posting as anyone else. A system should be as secure as the data you are trying to protect within it.

Balancing usability and security is one of the toughest parts of designing a secure system; anyone that's had to even remotely consider security as a factor knows this. It still holds, however, that usability always suffers as security improves.

Facebook is a great example. Their authentication scheme was originally only passwords. However, they've had problems t

Educate end-users on how to make passwords that are complex and easy to remember. Such a thing IS possible. For example teach users to pick a phrase or sentence and type that in, replacing all the instances of the letter E with the number 3 and to capitalize all vowels. All the user needs to remember is the phrase and the rules to make it complex. And the phrase can be something VERY easy to remember like "my daughter was born in march" which turns into "mydAught3rwAsbOrnInmArch". Maybe you leave the spaces in. Maybe you change A to 4 or L to 1. Whatever the user wants.

but we just ran a cracker program on the passwd file )on Solaris at the time) and exposed about 50% of the passwords. Then we went to the affected users and said, "This is your password, right?" After the first shock passed we would say, "It's too easy. You need to change it. Next week we'll run the cracker program again." We also sent around a little tutorial on how to create good passwords by using initials of a memorized sentence (as some have suggested here) After about four runs we were down to less than 10%, and we called it good.

So what you're saying is, you hamstrung 100% of employees to still leave 10% of your employees vulnerable, when no doubt it only takes one opening for anyone to get to any information that matters on your network...

TechRepublic [com.com] covered this almost a month ago, though it still gets sidetracked (like the Boston article) in a way that exemplifies the bigger issue.

Particularly, the point is not about password ageing, which is merely one example of how controls are often ineffective at achieving the security objectives. The bigger problem is that the usual IT security industry mantra has total disregard for all the other IT objectives. The goal (the ultimate, parent objective) of IT is to assist the organisation in achieving its objectives. IT security is just one objective for achieving that goal, but all of them are important.

When evaluating implementing security controls do not simply consider security. You also have to consider things like productivity, expense, risk, or how it might make it harder for the company to respond to customer requirements. Failing to do this is why users’ rejection of the security advice they receive is entirely rational from an economic perspective: they are pursuing objectives and IT security appears little more than an obstacle.

As a long time sysadmin, my experience has been, the more onerous the password aging algorithm, the more likely that passwords will be on yellow stickies under the keyboard.

For instance, if your password expires monthly and you're required to pick a password with upper case, lower case, numbers and symbols, I guarantee that the majority of your users will write it down and stick it to something easily accessible.

If you get really draconian about keeping passwords on stickies on the monitor or under the keyboard, they'll keep it in their pocketbook or stuck to the back of their cell phone, which is difficult to track and actually a worse security hole (because the building at least has physical security).

My opinion is that password aging and password complexity rules are a managerial line item, not really a security strategy. A true security strategy is a combination of good logging, regular analysis, and tools like password breakers.

In the mainframe days we put in place a delay before another attempt that exponentially grew each time the password was entered incorrectly.
First fail - 2 seconds delay,
Second fail - 4 seconds delay,
Third fail - 8 seconds...etc

Perhaps you should take your own advice, and find out what "subject-verb agreement" means? Neither "user" nor "they" is a verb or a subject, so I'm not sure how subject-verb agreement could be relevant here.

If you meant "pronoun agreement," you're still wrong. "They" agrees perfectly with a singular noun of indeterminate gender.